CVE-2026-64584 - Vulnerability Details

- usb: gadget: f_midi: cancel pending IN work before freeing the midi object

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_midi: cancel pending IN work before freeing the midi object

The f_midi driver embeds a work item (midi->work) whose handler,
f_midi_in_work(), dereferences the enclosing struct f_midi through
container_of(). This work is armed from two sites: f_midi_complete(),
on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA
rawmidi output-stream start.

Neither f_midi_disable() nor f_midi_unbind() cancels midi->work.
f_midi_disable() only disables the endpoints and drains the in_req_fifo;
it does not synchronize the work item, and the sound card is released
asynchronously to the final free of the midi object.

The midi object is reference-counted (midi->free_ref) and is freed in
f_midi_free() only once both the usb_function reference and the rawmidi
private_data reference have been dropped. In f_midi_unbind(),
f_midi_disable() runs before the sound card is released, so while the
USB endpoints are already disabled the rawmidi device is still usable by
an open substream. A concurrent userspace write on such a substream can
reach f_midi_in_trigger() and queue midi->work again after
f_midi_disable() has returned. A work item armed this way may still be
pending when the last reference drops and f_midi_free() proceeds to
kfree(midi), letting f_midi_in_work() dereference the struct after it
has been freed, a use-after-free.

For this reason cancelling midi->work in f_midi_disable() would not be
sufficient: the ALSA trigger path can rearm the work after disable()
returns. Cancelling at the refcount-zero free site is the boundary
after which neither arming source can survive, because by then both
references that keep the midi object alive have been dropped: the USB
endpoints are already disabled and the rawmidi device has been released.

Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero
block of f_midi_free(), before the embedded work_struct is freed along
with the rest of the structure. opts->lock is a sleeping mutex, so
calling cancel_work_sync() under it is permitted, and the handler takes
midi->transmit_lock rather than opts->lock, so no self-deadlock can
occur while it waits for a running instance of the work to finish.

This issue was found by an in-house static analysis tool.

Published: 2026-08-06

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free flaw exists in the Linux kernel f_midi USB gadget driver. The driver schedules a work item that accesses its parent midi structure. When the driver is released, the work item may still be pending and is not cancelled, causing a dereference of freed memory. This flaw can lead to arbitrary kernel code execution or a crash, allowing an attacker to gain elevated privileges or disrupt system availability. The description does not state how the flaw is triggered; the likely attack vector is inferred from references to USB IN‑endpoints and ALSA rawmidi trigger paths, suggesting that an attacker may be able to rearm the work via crafted USB MIDI packets or by controlling the rawmidi device.

Affected Systems

The vulnerability affects any Linux kernel that includes the f_midi USB gadget driver and has not yet applied the vendor‑supplied patch that cancels pending work before freeing the midi object. This includes all currently supported Linux kernel releases at the time of discovery. No specific kernel version range is supplied, so all affected builds prior to the patch are at risk.

Risk and Exploitability

The CVSS score is 7.8, indicating high severity, and use‑after‑free bugs in kernel code can potentially offer kernel‑level privilege escalation. Based on the description, it is inferred that the attack vector involves sending crafted USB MIDI packets after disabling the device or manipulating the local rawmidi substream to rearm the pending work. The EPSS score is < 1%, and the issue is not listed in CISA's KEV catalog, indicating that no known exploit has been publicly disclosed yet. Nonetheless, due to the kernel nature of the flaw, the potential impact warrants immediate attention.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3635523e9b96213969693c320302d536774d8e9b`	affected	< f3c6f2c38062703d3dc7f86958bb0790c6959add
`8653d71ce3763aedcf3d2331f59beda3fecd79e4`	affected	< df18150126f66817e4d3f79f309e9c92d6ff384e
`8653d71ce3763aedcf3d2331f59beda3fecd79e4`	affected	< 620955b222c47332297d6bf38f78541aa699238a
`8653d71ce3763aedcf3d2331f59beda3fecd79e4`	affected	< 380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9
`8653d71ce3763aedcf3d2331f59beda3fecd79e4`	affected	< 87bc316dd6fc90072297c635e10b9aa6075ecda1
`8653d71ce3763aedcf3d2331f59beda3fecd79e4`	affected	< f45089eaad0a083d71d84ff175741d7e157d9b69
`8653d71ce3763aedcf3d2331f59beda3fecd79e4`	affected	< ac9a51d910bb7465c554c45320cb6c09f3d0b49d
`8653d71ce3763aedcf3d2331f59beda3fecd79e4`	affected	< 5650c18d93a1db7e27cb5a40b394747eb4686d5b
`89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d`	affected	—
`5.10.235`	affected	< 5.10.265
`5.4.291`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8653d71ce3763aedcf3d2331f59beda3fecd79e4,380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9)`	affected	code_commit	—
`[8653d71ce3763aedcf3d2331f59beda3fecd79e4,87bc316dd6fc90072297c635e10b9aa6075ecda1)`	affected	code_commit	—
`[8653d71ce3763aedcf3d2331f59beda3fecd79e4,f45089eaad0a083d71d84ff175741d7e157d9b69)`	affected	code_commit	—
`[8653d71ce3763aedcf3d2331f59beda3fecd79e4,ac9a51d910bb7465c554c45320cb6c09f3d0b49d)`	affected	code_commit	—
`[8653d71ce3763aedcf3d2331f59beda3fecd79e4,5650c18d93a1db7e27cb5a40b394747eb4686d5b)`	affected	code_commit	—
`89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d`	affected	code_commit	—
`3635523e9b96213969693c320302d536774d8e9b`	affected	code_commit	—
`[5.4.291,5.5)`	affected	semver	—
`[5.10.235,5.11)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.12`	affected	semver	—
`[0,5.12)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that contains the f_midi_free() fix, which cancels pending work before freeing the midi object.
Disable the USB gadget f_midi driver or block the device via udev rules or sysfs to prevent the firmware from loading if an immediate kernel upgrade is not possible.
Restrict local access to the rawmidi device by tightening permissions or using kernel scheduling to mitigate the trigger path.

Generated by OpenCVE AI on August 8, 2026 at 16:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update
Debian DSA	DSA-6415-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00117.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9
https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b
https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a
https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1
https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d
https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e
https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add
https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add

Sat, 08 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 08 Aug 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 06 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: cancel pending IN work before freeing the midi object The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through container_of(). This work is armed from two sites: f_midi_complete(), on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA rawmidi output-stream start. Neither f_midi_disable() nor f_midi_unbind() cancels midi->work. f_midi_disable() only disables the endpoints and drains the in_req_fifo; it does not synchronize the work item, and the sound card is released asynchronously to the final free of the midi object. The midi object is reference-counted (midi->free_ref) and is freed in f_midi_free() only once both the usb_function reference and the rawmidi private_data reference have been dropped. In f_midi_unbind(), f_midi_disable() runs before the sound card is released, so while the USB endpoints are already disabled the rawmidi device is still usable by an open substream. A concurrent userspace write on such a substream can reach f_midi_in_trigger() and queue midi->work again after f_midi_disable() has returned. A work item armed this way may still be pending when the last reference drops and f_midi_free() proceeds to kfree(midi), letting f_midi_in_work() dereference the struct after it has been freed, a use-after-free. For this reason cancelling midi->work in f_midi_disable() would not be sufficient: the ALSA trigger path can rearm the work after disable() returns. Cancelling at the refcount-zero free site is the boundary after which neither arming source can survive, because by then both references that keep the midi object alive have been dropped: the USB endpoints are already disabled and the rawmidi device has been released. Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero block of f_midi_free(), before the embedded work_struct is freed along with the rest of the structure. opts->lock is a sleeping mutex, so calling cancel_work_sync() under it is permitted, and the handler takes midi->transmit_lock rather than opts->lock, so no self-deadlock can occur while it waits for a running instance of the work to finish. This issue was found by an in-house static analysis tool.
Title		usb: gadget: f_midi: cancel pending IN work before freeing the midi object
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9 https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1 https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-06T07:06:25.953Z

Updated: 2026-08-19T16:29:12.890Z

Reserved: 2026-07-19T15:36:31.798Z

Link: CVE-2026-64584

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-06T08:16:33.543

Modified: 2026-08-19T17:20:18.703

Link: CVE-2026-64584

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-08T17:00:05Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object